Data Exfiltration Planning

You have achieved persistent access to an internal network during an authorized penetration test. Plan a data exfiltration operation to demonstrate impact to the client.

**Data Identification**
- How do you identify high-value data without downloading everything?
- What file types and directories are highest priority in a corporate environment?
- How do you search for files containing keywords like "password", "confidential", "credit card" at scale?

**Egress Channel Selection**
- What outbound channels are typically allowed through enterprise firewalls? (HTTP/S, DNS, SMTP)
- How does DNS exfiltration work and what are its speed limitations?
- When is HTTPS the best egress channel vs when is it detectable?
- How do you use cloud services (S3, GitHub, Pastebin) as exfiltration endpoints?

**Data Staging**
- Why do you stage data before exfiltrating? What are the risks of exfiltrating directly?
- How do you compress and encrypt data before exfil to reduce size and avoid content inspection?
- Where on the target system is a safe staging location?

**Transfer Techniques**
- How do you exfiltrate data over an existing C2 channel vs setting up a separate channel?
- What is LOLBAS exfiltration? (certutil, bitsadmin, curl from Windows)
- How do you exfiltrate from an air-gapped or highly restricted network?

**Avoiding Detection**
- What size thresholds trigger DLP alerts in most environments?
- How do you time your exfiltration to blend with legitimate traffic patterns?
- What does SSL inspection catch and how do you avoid it?

Output:
- Exfiltration channel comparison (speed, detection risk, setup complexity)
- DNS exfiltration explanation with tool options
- Staging and encryption workflow